CISM Exam Questions and Answers | Exam-Dumps (Page: 20)

QUESTION: 96

To justify the need to invest in a forensic analysis tool, an information security manager should FIRST:

review the functionalities and implementation requirements of the solution.
review comparison reports of tool implementation in peer companies.
provide examples of situations where such a tool would be useful.
substantiate the investment in meeting organizational needs.

Answer(s): D

Explanation:

Any investment must be reviewed to determine whether it is cost effective and supports the organizational strategy. It is important to review the features and functionalities provided by such a tool, and to provide examples of situations where the tool would be useful, but that comes after substantiating the investment and return on investment to the organization.

Reveal Solution Next Question

QUESTION: 97

The MOST useful way to describe the objectives in the information security strategy is through:

attributes and characteristics of the 'desired state."
overall control objectives of the security program.
mapping the IT systems to key business processes.
calculation of annual loss expectations.

Answer(s): A

Explanation:

Security strategy will typically cover a wide variety of issues, processes, technologies and outcomes that can best be described by a set of characteristics and attributes that are desired. Control objectives are developed after strategy and policy development. Mapping IT systems to key business processes does not address strategy issues. Calculation of annual loss expectations would not describe the objectives in the information security strategy.

Reveal Solution Next Question

QUESTION: 98

In order to highlight to management, the importance of network security, the security manager should FIRST:

develop a security architecture.
install a network intrusion detection system (NIDS) and prepare a list of attacks.
develop a network security policy.
conduct a risk assessment.

Answer(s): D

Explanation:

A risk assessment would be most helpful to management in understanding at a very high level the threats, probabilities and existing controls. Developing a security architecture, installing a network intrusion detection system (NIDS) and preparing a list of attacks on the network and developing a network security policy would not be as effective in highlighting the importance to management and would follow only after performing a risk assessment.

Reveal Solution Next Question

QUESTION: 99

When developing an information security program, what is the MOST useful source of information for determining available resources?

Proficiency test
Job descriptions
Organization chart
Skills inventory

Answer(s): D

Explanation:

A skills inventory would help identify- the available resources, any gaps and the training requirements for developing resources. Proficiency testing is useful but only with regard to specific technical skills. Job descriptions would not be as useful since they may be out of date or not sufficiently detailed. An organization chart would not provide the details necessary to determine the resources required for this activity.

Reveal Solution Next Question

QUESTION: 100

The MOST important characteristic of good security policies is that they:

state expectations of IT management.
state only one general security mandate.
are aligned with organizational goals.
govern the creation of procedures and guidelines.

Answer(s): C

Explanation:

The most important characteristic of good security policies is that they be aligned with organizational goals. Failure to align policies and goals significantly reduces the value provided by the policies. Stating expectations of IT management omits addressing overall organizational goals and objectives. Stating only one general security mandate is the next best option since policies should be clear; otherwise, policies may be confusing and difficult to understand. Governing the creation of procedures and guidelines is most relevant to information security standards.

Reveal Solution Next Question

ISACA CISM Exam (page: 20) ISACA Certified Information Security Manager Updated on: 25-Dec-2025

QUESTION: 96

Explanation:

QUESTION: 97

Explanation:

QUESTION: 98

Explanation:

QUESTION: 99

Explanation:

QUESTION: 100

Explanation:

ISACA CISM Exam (page: 20)
ISACA Certified Information Security Manager
Updated on: 25-Dec-2025